Executive brief
A memory allocation vulnerability in the Linux kernel's vhost subsystem allows unbounded allocation of IOTLB (I/O Translation Lookaside Buffer) entries, potentially exhausting system memory and causing denial of service. Affected systems running virtual devices that use vhost may experience availability issues when IOTLB entries are continuously allocated without proper limits.
Technical details
The vulnerability exists in vhost_iotlb_add_range_ctx() where non-retiring IOTLB tables can continue allocating entries beyond their configured limit, as the function only enforces entry limits when retiring is enabled and VHOST_IOTLB_FLAG_RETIRE is set. An attacker with access to guest or userspace-controlled I/O mapping requests can trigger repeated allocations to exhaust kernel memory. The fix implements proper bounds checking at allocation points, enforces minimum entry limits (e.g., 2 entries for full-range mappings), returns -ENOSPC when tables are full without retiring enabled, and treats zero-limit IOTLBs as configuration errors returning -EINVAL. The patch was merged into the Linux kernel to prevent unbounded memory consumption.
Affected products
- Linux Linux kernel before patch resolution (CVE-2026-74713)
Timeline
- 2026-08-22: disclosed: CVE-2026-74713 published